[mikecerisano]

Two filenames can be distinct on disk but compare equal in Swift. Disposable HFS+ images reproduced two crashes with K.mov and K.mov: one before copying, another while checking the destination after verification.

The engine now refuses an ambiguous captured source manifest before copying. Ambiguous destination metadata produces failed results, with no new MHL history or safe verdict. Sources, existing files and prior histories remain intact. No filename rewriting or verification-default change.

Stacked on #61 so this review contains only the filename fix, regressions and its validation record.

Local validation:

• Both original contained workers exited with SIGTRAP; patched workers returned a normal refusal or failed result, preserving the protected bytes.
• Nine focused regressions passed with zero skips/failures, including real mounted HFS+ source and destination cases. The same nine passed under Rosetta x86_64 Release; physical Intel hardware remains untested.
• Engine Debug and Release each: 195 XCTest passes / 43 skips and 217 Swift Testing passes / 6 skips, zero failures.
• Full Mac app: 1,282 passed / 23 skipped / zero failures. The first run's stale error-wording assertion was corrected and its failed result retained; the full fresh rerun passed.
• Shared iOS-device and universal Mac Release builds passed. A local universal signed diagnostic archive passed deep/strict verification; it was not installed or published.
• Seven research images were normally detached and removed. Compact crash evidence, source/history snapshots and test receipts remain retained.

See docs/validation/UNICODE_SOURCE_PREFLIGHT_20261020.md for exact counts, 78 separate raw driver probes and coverage limits. Final signed-UI and physical-mobile walkthroughs remain separate. These reproductions do not establish the cause of #10 or #23. GitHub Actions credits are exhausted; local receipts are the gate. No merge or release is included.